Refactoring

ONLYOFFICE · Feb 14, 2024 · a6a73ff · a6a73ff
1 parent 33c5852
commit a6a73ff
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 15 deletions.
diff --git a/DesktopEditor/raster/Metafile/svg/SvgObjects/CImage.cpp b/DesktopEditor/raster/Metafile/svg/SvgObjects/CImage.cpp
@@ -67,13 +67,13 @@ namespace SVG
 		if (NSProcessEnv::IsPresent(NSProcessEnv::Converter::gc_allowPrivateIP))
 			bIsAllowExternalLocalFiles = NSProcessEnv::GetBoolValue(NSProcessEnv::Converter::gc_allowPrivateIP);
 
-		if (bIsAllowExternalLocalFiles || (!wsFilePath.empty() && L'.' != wsFilePath[0]))
-		{
-			wsFilePath = pFile->GetWorkingDirectory() + L'/' + wsFilePath;
+		if (!bIsAllowExternalLocalFiles && wsFilePath.length() >= 3 && L"../" == wsFilePath.substr(0, 3))
+			return true;
 
-			if (!NSFile::CFileBinary::Exists(wsFilePath) || !NSFile::CFileBinary::ReadAllBytes(wsFilePath, &pBuffer, ulSize))
-				return false;
-		}
+		wsFilePath = pFile->GetWorkingDirectory() + L'/' + wsFilePath;
+
+		if (!NSFile::CFileBinary::Exists(wsFilePath) || !NSFile::CFileBinary::ReadAllBytes(wsFilePath, &pBuffer, ulSize))
+			return false;
 		#endif
 
 		if (NULL == pBuffer)

diff --git a/HtmlFile2/htmlfile2.cpp b/HtmlFile2/htmlfile2.cpp
@@ -102,6 +102,25 @@ std::wstring EncodeXmlString(const std::wstring& s)
 	return sRes;
 }
 
+bool GetStatusUsingExternalLocalFiles()
+{
+	if (NSProcessEnv::IsPresent(NSProcessEnv::Converter::gc_allowPrivateIP))
+		return NSProcessEnv::GetBoolValue(NSProcessEnv::Converter::gc_allowPrivateIP);
+
+	return true;
+}
+
+bool CanUseThisPath(const std::wstring& wsPath, bool bIsAllowExternalLocalFiles)
+{
+	if (bIsAllowExternalLocalFiles)
+		return true;
+
+	if (wsPath.length() >= 3 && L"../" == wsPath.substr(0, 3))
+		return false;
+
+	return true;
+}
+
 class CHtmlFile2_Private
 {
 public:
@@ -1849,9 +1868,12 @@ class CHtmlFile2_Private
 			return;
 		}
 
-		bool bIsAllowExternalLocalFiles = true;
-		if (NSProcessEnv::IsPresent(NSProcessEnv::Converter::gc_allowPrivateIP))
-			bIsAllowExternalLocalFiles = NSProcessEnv::GetBoolValue(NSProcessEnv::Converter::gc_allowPrivateIP);
+		const bool bIsAllowExternalLocalFiles = GetStatusUsingExternalLocalFiles();
+
+		sSrcM = NSSystemPath::ShortenPath(sSrcM);
+
+		if (!CanUseThisPath(sSrcM, bIsAllowExternalLocalFiles))
+			return;
 
 		int nImageId = -1;
 		std::wstring sImageSrc, sExtention;
@@ -2145,13 +2167,9 @@ class CHtmlFile2_Private
 			if(nHRefLen == std::wstring::npos)
 				break;
 
-			std::wstring sImageName = NSSystemPath::ShortenPath(sSVG.substr(nHRef, nHRefLen - nHRef));
-
-			bool bIsAllowExternalLocalFiles = true;
-			if (NSProcessEnv::IsPresent(NSProcessEnv::Converter::gc_allowPrivateIP))
-				bIsAllowExternalLocalFiles = NSProcessEnv::GetBoolValue(NSProcessEnv::Converter::gc_allowPrivateIP);
+			const std::wstring sImageName = NSSystemPath::ShortenPath(sSVG.substr(nHRef, nHRefLen - nHRef));
 
-			if (!bIsAllowExternalLocalFiles && !sImageName.empty() && L'.' == sImageName[0])
+			if (!CanUseThisPath(sImageName, GetStatusUsingExternalLocalFiles()))
 				break;
 
 			std::wstring sTIN(sImageName);